diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 000000000..2a407017e
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,19 @@
+name: Shellcheck
+on:
+  pull_request:
+    branches:
+      - master
+jobs:
+  shellcheck:
+    name: Shellcheck
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Run ShellCheck
+      uses: ludeeus/action-shellcheck@2.0.0
+      env:
+        SHELLCHECK_OPTS: -x # allow outside sources
+      with:
+        # This code comes directly from upstream libsecp256k1
+        # and should not be linted here.
+        ignore_paths: ./secp256k1-sys/depend/**/*.sh
diff --git a/contrib/extra_tests.sh b/contrib/extra_tests.sh
index e05a519e5..909d9c254 100755
--- a/contrib/extra_tests.sh
+++ b/contrib/extra_tests.sh
@@ -42,10 +42,6 @@ say() {
     echo "extra_tests: $1"
 }
 
-say_err() {
-    say "$1" >&2
-}
-
 verbose_say() {
     if [ "$flag_verbose" = true ]; then
 	say "$1"
diff --git a/contrib/sanitizer.sh b/contrib/sanitizer.sh
index d18cf7493..86e3c69bb 100755
--- a/contrib/sanitizer.sh
+++ b/contrib/sanitizer.sh
@@ -48,10 +48,6 @@ say() {
     echo "extra_tests: $1"
 }
 
-say_err() {
-    say "$1" >&2
-}
-
 verbose_say() {
     if [ "$flag_verbose" = true ]; then
 	say "$1"
diff --git a/githooks/pre-commit b/githooks/pre-commit
index 8c45989f4..c42944236 100755
--- a/githooks/pre-commit
+++ b/githooks/pre-commit
@@ -26,8 +26,8 @@ if [ "$allownonascii" != "true" ] &&
 	# Note that the use of brackets around a tr range is ok here, (it's
 	# even required, for portability to Solaris 10's /usr/bin/tr), since
 	# the square bracket bytes happen to fall in the designated range.
-	test $(git diff --cached --name-only --diff-filter=A -z $against |
-	  LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0
+	test "$(git diff --cached --name-only --diff-filter=A -z "$against" |
+	  LC_ALL=C tr -d '[ -~]\0' | wc -c)" != 0
 then
 	cat <<\EOF
 Error: Attempt to add a non-ASCII file name.
@@ -44,7 +44,7 @@ EOF
 fi
 
 # If there are whitespace errors, print the offending file names and fail.
-git diff-index --check --cached $against -- || exit 1
+git diff-index --check --cached "$against" -- || exit 1
 
 # Check that code lints cleanly.
 cargo clippy --features=rand,std,recovery,lowmemory,global-context --all-targets -- -D warnings || exit 1